{"id":"CVE-2014-125137","kind":"vulnerability","aliases":["CVE-2014-125137"],"related":[],"title":"qEngine, Kemana Directory and Cart Engine: admin file inclusion reads server files","description":"C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.","summary":"Three PHP products from C97net, qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0, have a local file inclusion flaw in the run parameter of admin/task.php. An authenticated administrator can use directory traversal sequences there to include and read any file the web server can read.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qEngine CMS","fixed":[],"affected":"<= 6.0.0","ecosystem":"vendor"},{"name":"Kemana Directory","fixed":[],"affected":"<= 1.5.6","ecosystem":"vendor"},{"name":"Cart Engine","fixed":[],"affected":"<= 3.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["cart-engine","cms","kemana","lfi","other","php","qengine","self-hosted"],"not_affected_if":["auth-required","managed-hosting","not-installed"],"how_to_check":"Look for task.php in the admin directory of qEngine CMS (<=6.0.0), Kemana Directory (<=1.5.6) or Cart Engine (<=3.0.0). Any install of these versions is affected; no fixed version is known.","fix":"unknown: no patched release found from C97net; restrict /admin/task.php (IP allowlist, web server auth) or retire the product","status":"open","published_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:35+00:00","updated_at":"2026-10-28T03:33:13+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-28T03:32:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"qEngine, Kemana Directory and Cart Engine: admin file inclusion reads server files","impact":"medium","summary":"Three PHP products from C97net, qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0, have a local file inclusion flaw in the run parameter of admin/task.php. An authenticated administrator can use directory traversal sequences there to include and read any file the web server can read.","category":"other","nicknames":[],"who_cares":["php","self-hosted","cms"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads server files such as configuration files and secrets.","analyst_note":"Sources do not give a fixed version or vendor advisory; check the C97net vendor site and the NVD entry for a patched release.","how_to_check":"- Check whether `admin/task.php` exists in the web root of qEngine CMS, Kemana Directory or Cart Engine.\n- Check the installed version against `6.0.0` for qEngine CMS, `1.5.6` for Kemana Directory and `3.0.0` for Cart Engine.","needs_analyst":true,"not_affected_if":["auth-required","not-installed"],"who_is_affected":"Sites running qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6 or Cart Engine up to 3.0.0 are exposed. The attacker must already hold an administrator account on the application, so sites with no such accounts exposed to untrusted users carry less risk. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3349,"output_tokens":595,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not give a fixed version or vendor advisory; check the C97net vendor site and the NVD entry for a patched release.","search":"'-125137':15A,18A '-2014':14A,17A '1.5.6':49B,95C '3.0.0':54B,100C '6.0.0':45B,91C 'admin':7A 'admin/task.php':66B,112C 'administr':69B,114C 'authent':68B,113C 'c97net':41B,87C 'cart':5A,23A,26B,51B,97C 'cart-engin':25B 'cms':20A,28B,43B,89C 'contain':101C 'cve':13A,16A 'directori':3A,47B,72B,93C,117C 'directory':22A 'disclos':127C 'engin':6A,27B,52B,98C 'engine':24A 'file':8A,12A,58B,81B,104C,129C 'flaw':60B 'host':36B 'includ':77B,125C 'inclus':9A,59B,105C 'kemana':2A,21A,29B,46B,92C 'lfi':30B 'local':57B,103C,128C 'paramet':64B,110C,123C 'php':32B,38B 'product':39B 'qengin':1A,33B,42B,88C 'qengine':19A 'read':10A,79B,86B 'readabl':130C 'run':63B,109C,122C 'self':35B 'self-host':34B 'sequenc':74B,119C 'server':11A,84B,134C 'suppli':116C 'three':37B 'travers':73B,118C 'use':71B 'vulner':106C 'web':83B,133C","nicknames":[],"mitigations":[],"who_affected":"Sites running qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6 or Cart Engine up to 3.0.0 are exposed. The attacker must already hold an administrator account on the application, so sites with no such accounts exposed to untrusted users carry less risk. The sources do not name a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2014-125137","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125137","severity":null,"published_at":"2026-10-28T03:17:07+00:00","modified_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2014-125137:934","url":null,"severity":null,"published_at":"2026-10-28T03:33:13+00:00","modified_at":"2026-10-28T03:33:13+00:00","first_seen_at":"2026-10-28T03:33:13+00:00","fetched_at":"2026-10-28T03:33:13+00:00","note":"Researcher advisories (Zero Science ZSL-2014-5173/5181, ExploitDB 32508, Mar 2014) confirm authenticated LFI via 'run' param of task.php. Vendor never published a fix (promised April 2014 patch; none found), so fix unknown. Nothing verified: no vendor page read. Public PoC exists, no exploitation reports."}],"documents":[{"id":8891,"url":"https://www.zeroscience.mk/advisories/ZSL-2014-5181.html","title":"Cart Engine 3.0.0 (task.php) LFI - Zero Science Lab ZSL-2014-5181","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":8892,"url":"https://www.exploit-db.com/exploits/32508","title":"Kemana Directory 1.5.6 task.php LFI (ExploitDB 32508)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":8893,"url":"https://cxsecurity.com/issue/WLB-2014030189","title":"qEngine CMS 6.0.0 task.php LFI (ZSL-2014-5173)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}